Z-Way Home Automation Part 2: An Analysis of Publicly Vulnerable Gateways

After my previous post regarding security concerns with the Z-Way home automation controller, John Matherly (founder of Shodan) messaged me that he was launching a scan of port 8083. I was interested to see if any of these devices had been put online publicly, so he sent me the results after the scan completed (thanks, John!). The results were interesting enough that I thought I’d share them in a follow-up post.

After parsing out all of the IPs from Shodan’s results, I ran a script that determined if each IP was actually a Z-Way gateway. This resulted in a list of about 70 publicly accessible gateways. While this number doesn’t seem very large, I thought it was significant given the technical niche that Z-Way caters to.

My next step was to write a script that would enumerate through all of the positively identified gateways and request the attached devices from the Z-Way API, saving the results to a file.

Python

1

2

3

4

5

6

7

8

9

10

11

12

13

14

importrequests

withopen('8083-controllers.txt')asdata_file:

forip indata_file:

url='http://%s:8083/ZWaveAPI/Data/0'%ip.strip()

try:

r=requests.post(url)

file=open('output/%s.txt'%ip,'w')

file.write(r.text)

file.close()

except:

print("%s failed"%ip)

Grepping through the results, I found some interesting device names, including light switches, door locks, baby monitors, and garage door sensors. Next, I wanted to parse the device names as well as determine which IPs had the most devices attached. I parsed the JSON API results again:

Python

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

importjson

importos

forfileinos.listdir("output"):

iffile.endswith(".txt"):

data=json

withopen('output/%s'%file)asdata_file:

data=json.load(data_file)

devices=data.get('devices')

forkey,value indevices.items():

try:

name=value.get('data').get('givenName').get('value')

ifname!="":

print('%s - %s'%(file,name))

except:

pass

This gave me a simple text file containing each device, along with its associated gateway IP. Here’s the full dump of device names that are publicly exposed (with obfuscated IPs). The below graph plots the number of devices for each IP.

Below is a partial screenshot showing the control interface of the gateway with the most devices:

There are over 200 devices exposed in total and, again, these devices can be controlled remotely without any authentication. I’m not sure what can be done about this; attempting to reach out to these individuals seems impractical. At minimum, this serves as another reminder to be careful about exposing devices publicly to the internet.

Share this:

Gary Barclay

Mindboggling…and people are starting to add front door locks to their device lists. I wonder how long until the first internet enabled robbery takes place, if it hasn’t already.